Malicious Office (OLE) / .XLSX — malware analysis report

Static analysis result for SHA-256 886da4a3614e5d82…

MALICIOUS

Office (OLE) / .XLSX

89.0 KB Created: 2020-09-07 02:03:38 Authoring application: Microsoft Excel
MD5: 8512f5a4bbb6a6dfbc77fb095f936bf1 SHA-1: 864b34deb8fc7d4ddd2a290921514b8925617845 SHA-256: 886da4a3614e5d822a68bfe27ba45408e08e0f8279c7f8ad3b04146de20b4641
280 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample is a malicious Excel file containing a Workbook_Open VBA macro. This macro is designed to download and execute a second-stage payload from the URL 'https://thepohlfoundation.com/owen.exe'. The presence of obfuscated auto-execution logic and the critical heuristic for downloading and executing a file strongly indicate this behavior.

Heuristics 6

  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • ClamAV: Xls.Dropper.Agent-9750830-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Agent-9750830-0
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
a66a8e36c2c379c94763078a4ad64e5998e40b910aacd42aa124e71686544b53		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 8339 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.